Aegentra
UK
United KingdomAustraliaNew Zealand

PECB / Practitioner

Certified Incident Responder
Course & exam bundle.

Hands-on cybersecurity incident response — ransomware, malware, perimeter threats, persistence, and digital forensics.

Compare learning formatsExplore the curriculum

Online · Self-paced · English

Verify PECB partner ID 232290

Course and exam, together

Choose your learning format.

Compare the course formats and their inclusions. Choose a bundle to pay securely on Stripe. Stripe asks for your email, which we use to assign your PECB course.

Self-Study course and exam bundle

Read and revisit the official slide-based materials at your own pace. No video lectures or live teaching.

What’s included
  • 12 months of myPECB course access
  • Official PECB course slides
  • Official PECB exam voucher: 2 attempts — initial exam + one free retake if needed
  • Certification application fee included
  • First-year certification maintenance fee included where applicable

Base price (excl. VAT)£444.00

Total to pay (incl. 20% UK VAT)£532.80

Per learner · GBP

Buy
Exam and purchase conditions

Complete the exam, included retake and application within 12 months of purchase. The first retake requires at least 15 days after an unsuccessful attempt. PECB reviews eligibility before awarding a credential; buying a bundle does not guarantee certification. An enquiry does not create an order. An order is confirmed after successful payment and acceptance.

Choose your payment currency in the top navigation. Prices shown are for UK personal purchases; other locations and business purchases need a written quote.

Your enrolment

Certified Incident Responder

Total payable in GBP

—

Order details

Your selected course

    The badge identifies the course, not a credential already earned. One-off payment; no automatic renewal. Any valid promotion is applied on Stripe’s final payment screen.

    PECB access within 24 hours of confirmed payment.

    Purchase and billing details

    Base prices exclude VAT; the UK total adds 20% VAT. Outside the UK? Request a written quote confirming applicable tax and your total before payment. Payment currency does not determine tax.

    UK prices are fixed in GBP. Other currencies use a current exchange quote; your selected currency is charged at checkout.

    This does not remove remedies for faulty or misdescribed content, rights relating to examination services, or the 10-day Labs money-back guarantee.

    Examination services are separate from digital-content access. Accepting early digital access does not waive service cancellation rights. Any request to start an examination service during the cancellation period is handled separately.

    PECB courses have no additional voluntary cancellation refund. This does not remove statutory rights. Labs has the separate 10-day guarantee.

    You need your email account, an internet connection and compatible equipment; check the course and PECB examination requirements before paying.

    Prefer to start after the cancellation period? Arrange a later start with the Academy before payment.

    You can review and correct this order before continuing. Stripe handles card details; we do not receive your full card number. Checkout and purchase information are in English. Save the terms.

    Loading your course and total…

    Personal purchases only. Business or reverse-charge request? Contact us before paying.

    Is this your next step?

    Who this course
    suits best.

    • Incident response team members and cybersecurity analysts managing security events
    • IT security professionals enhancing their technical and strategic incident response skills
    • Security operations centre (SOC) personnel involved in threat detection and response
    • Professionals transitioning into specialised incident response roles
    • Managers and team leaders coordinating incident response strategies and protocols

    Your learning format

    Independent study.
    Clear expectations.

    This course is listed as Self-Study only. Learn from the official course materials at your own pace; recorded presenter videos and live classes are not included.

    Which learning support is included?

    Self-Study is independent learning from the official materials. eLearning, where listed, adds recorded instruction; neither standard bundle promises live tuition or unlimited one-to-one support. For the listed ISO 27001 and ISO 42001 courses, the separately quoted consultancy option is explained above. PECB manages examination and certification decisions.

    Knowledge you can apply

    What you will
    work through.

    • Develop and implement effective incident response strategies and manage response efforts across teams and technologies.
    • Evaluate ransomware attack vectors and mitigation techniques and execute a robust response plan to minimise impact.
    • Analyse malware behaviours, create tailored remediation strategies, and use forensic techniques to trace and neutralise malicious code.
    • Identify and respond to external threats targeting network perimeters, with tools and techniques for early detection and containment.
    • Develop remediation plans to eliminate recurring threats and recognise advanced persistence strategies.

    Inside the course

    The curriculum.

    Modules describe the learning sequence. Day labels in the official curriculum do not mean scheduled live classes.

    Day 1 — Fundamentals of incident response and strategic handling
    • The incident response lifecycle and frameworks
    • Building and coordinating the response team
    • Strategic incident handling and response playbooks
    Day 2 — Ransomware and malware incident response
    • Ransomware attack vectors and containment
    • Malware behaviour analysis
    • Remediation and recovery strategies
    Day 3 — Perimeter threats detection, analysis, and response
    • Threat intelligence and early detection
    • Perimeter threat detection tools and techniques
    • Containment of external threats
    Day 4 — Persistence, forensics, and continual improvement
    • Detecting and remediating advanced persistence mechanisms
    • Digital forensics and evidence handling
    • Post-incident review and continual improvement
    Day 5 — Certification exam
    • PECB Certified Incident Responder exam
    • 3 hours, five competency domains

    The exam and credential

    Know what
    you are preparing for.

    Credential eligibility and the certification decision are assessed by PECB. Training does not certify your organisation.

    Format
    Open-book, technical exam
    Duration
    3 hours
    Questions
    20 technical questions in the current English PECB examination record
    Pass mark
    70%

    After passing, apply to PECB for the Incident Responder credential supported by your experience. The current course page and candidate handbook differ: the page lists two years of incident-response or cybersecurity experience and no project-hours requirement; the handbook lists two years overall with one relevant year, 200 project hours and a Provisional pathway. Obtain written confirmation from PECB of the applicable scheme before relying on an experience or project-hours threshold. PECB decides the award and requires its Code of Ethics.

    Before you enrol: prerequisites
    • Before attending, understand the fundamentals of cybersecurity and incident response.
    • The full credential has separate professional and project experience requirements; PECB assesses the application after the examination.

    From knowledge to a working decision

    An account shows suspicious activity

    Build a timeline from fictional alerts, identify what is known and unknown, and define escalation, evidence preservation and containment decisions.

    For an implementation or practitioner route, record a decision, owner, evidence requirement and review trigger. Explain your assumptions and what remains outside the exercise.

    Original optional study prompt, not an official PECB exam question, an additional included lab or evidence of professional experience. Use fictional information.

    Check the official PECB course catalogue

    Make time for the learning

    Your course.
    Your study plan.

    Turn the curriculum into a study plan: record your target dates, explain each topic in your own words and keep a list of questions to revisit. The downloadable sheet is pre-filled for this course and includes space for your notes. It is an optional Aegentra planning aid, not official PECB materials, an exam-question bank or evidence of professional experience. Use fictional examples, not confidential workplace information.

    Download your study planner (CSV)

    Certified Incident Responder · Editable spreadsheet · No sign-up required

    Before you book the exam.

    Check your exact exam

    Confirm the course, exam language, duration and permitted materials against PECB’s current exam listing and rules. Similar titles from different training providers can lead to different qualifications.

    PECB exam listing
    Prepare your exam environment

    Before booking, check the latest online-exam manual for identification, equipment, connectivity and room requirements. Ask PECB about reasonable accommodations early if you need them.

    PECB online-exam manual
    Plan the credential application

    Passing the exam and being awarded a particular credential are separate steps. Check the applicable experience, references and application requirements; do not assume a Lead title is awarded automatically.

    PECB certification requirements

    For permitted materials, exam conduct and accommodation requests, read PECB’s exam rules. Requirements can change; check the current rules for your exact exam.

    Your questions

    Before you choose.

    Is the official PECB exam included?

    Yes. Each listed bundle includes the official examination voucher: an initial attempt and one free retake if needed. Complete the exam, included retake and application within 12 months of purchase. The first retake requires at least 15 days after an unsuccessful attempt. PECB reviews eligibility before awarding a credential; buying a bundle does not guarantee certification.

    What is the difference between Self-Study and eLearning?

    Self-Study provides official slides for independent study. eLearning adds recorded PECB video lectures. Only the formats shown above are offered for this course.

    Does this include a certification fee?

    The bundle includes the application fee and first-year maintenance where applicable. Foundation certificates have no annual maintenance fee. Credential eligibility and ongoing requirements vary; PECB makes the award decision.

    Can I purchase online?

    Choose your course and learning format, review the total in your selected currency and pay securely through Stripe. PECB access is arranged within 24 hours after payment confirmation. Optional Labs access is activated for the matching course after confirmation.

    How does this PECB bundle compare with other UK training offers?

    Compare the exact awarding body and credential, curriculum, delivery format, exam inclusion, retake conditions, access period and eligibility. Similar course titles do not establish equivalence to another provider or scheme. These are PECB bundles; no CQI and IRCA, IAPP, EC-Council or Linux Foundation credential is implied.

    Does 12-month access mean 12 months of teaching?

    No. It is the material-access period, not a scheduled course duration or a promise of unlimited instructor support. The listed bundles are self-paced. Curriculum day labels describe a learning sequence; they are not booked live classroom dates.

    Which standard edition or syllabus should I check?

    Confirm the exact course edition and current PECB syllabus before enrolment, especially where a standard is being revised. Publication of a newer standard does not automatically update a training bundle or include a transition course. Confirm the course edition with the Academy before payment.

    Choose the right course for your role.

    Tell us what you need to achieve, what is in scope and where you are starting.

    Talk about your project